General

  • Target

    base.apk

  • Size

    1.7MB

  • Sample

    250127-m44r7swnhk

  • MD5

    511a806ca330acfd1b017840c2ef2490

  • SHA1

    76ddca680c45d4a24799733b7ec760a175a6f409

  • SHA256

    7badeb43e25c4bc7772b4e62d97a7bffc84a02b8f50ea83e8ab8acb598a20bad

  • SHA512

    1e8447dc3d9aff9ad141d68e855c18883e04550cc44894f701ddc9285433d4877133b9a8625f2a6e692d0e0eef64b7ce63c3caa2623d1ade2964a32f38ad6869

  • SSDEEP

    24576:Fbw9zfr2b+z//r1Jo/KVRymSwPA3pkyN1goJ7a8H2GYofB0VbYSJKA:Fbw9zfr28D3RVA3pZJ7ae2kfudYSJKA

Malware Config

Extracted

Family

tanglebot

C2

https://icq.im/AoLH58pXY8ejJTQiWg8

https://t.me/pempeppepepep

https://t.me/xpembeppep2p2

Targets

    • Target

      base.apk

    • Size

      1.7MB

    • MD5

      511a806ca330acfd1b017840c2ef2490

    • SHA1

      76ddca680c45d4a24799733b7ec760a175a6f409

    • SHA256

      7badeb43e25c4bc7772b4e62d97a7bffc84a02b8f50ea83e8ab8acb598a20bad

    • SHA512

      1e8447dc3d9aff9ad141d68e855c18883e04550cc44894f701ddc9285433d4877133b9a8625f2a6e692d0e0eef64b7ce63c3caa2623d1ade2964a32f38ad6869

    • SSDEEP

      24576:Fbw9zfr2b+z//r1Jo/KVRymSwPA3pkyN1goJ7a8H2GYofB0VbYSJKA:Fbw9zfr28D3RVA3pZJ7ae2kfudYSJKA

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries the mobile country code (MCC)

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks